CVE-2022-0024: PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit
A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.23; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-0024?
CVE-2022-0024 is a vulnerability in Palo Alto Networks PAN-OS software that allows an authenticated network-based administrator to upload a specially crafted configuration and potentially execute arbitrary code with root privileges.
How does CVE-2022-0024 affect Palo Alto Networks PAN-OS software?
CVE-2022-0024 affects Palo Alto Networks PAN-OS software versions 8.1.0 to 8.1.23, 9.0.0 to 9.0.16, 9.1.0 to 9.1.13, 10.0.0 to 10.0.10, and 10.1.0 to 10.1.5.
What is the severity of CVE-2022-0024?
CVE-2022-0024 has a severity rating of 7.2 (critical).
How can an attacker exploit CVE-2022-0024?
An attacker with authenticated network access can exploit CVE-2022-0024 by uploading a specially created configuration to disrupt system processes and potentially execute arbitrary code with root privileges.
Is there a fix available for CVE-2022-0024?
Yes, Palo Alto Networks has released patches to address the vulnerability. It is recommended to update to the latest version of PAN-OS software.